Kling CLI plugin OAuth cannot authenticate in remote ChatGPT Work runtime

Summary

The Kling AI CLI plugin is currently unusable for account authentication when it runs inside ChatGPT Work/Codex's remote, headless runtime.

Reproduction

1. Select the Kling AI CLI plugin in ChatGPT Work/Codex.
2. Start authentication through the plugin, which invokes the official Global CLI approximately as follows:

npm exec --yes --registry=https://registry.npmjs.org --package=@klingai/cli-global@latest -- kling login

3. The CLI detects a headless environment and provides an OAuth authorization URL with this redirect URI:

http://127.0.0.1:8787/callback

4. Open the authorization URL in the user's browser and approve access.
5. Run:

kling who_am_i

Actual result

The callback reaches 127.0.0.1 on the user's local machine, rather than the remote Work/Codex runtime where the CLI is listening. The access token is never saved and kling who_am_i returns:

No login state found

Why users cannot work around this

ChatGPT Work/Codex users do not have a reachable ingress URL for the runtime and cannot configure SSH port forwarding. This is a standalone CLI invocation, not an MCP server configured through codex mcp.

Requested resolution

Please make this third-party CLI/plugin authentication flow usable in remote Codex runtimes through at least one of:

1. Device-code / browser-code OAuth supported by the Kling CLI plugin.
2. Secure API-key authentication supported by the plugin.
3. A ChatGPT-managed OAuth callback instead of a loopback redirect.

Without one of these options, the advertised Kling video-generation integration cannot be authenticated by users with existing Kling accounts in ChatGPT Work.

Start by reproducing the headless authentication flow with the documented npm exec command, then inspect how the Kling CLI plugin invokes kling login and handles the http://127.0.0.1:8787/callback redirect. Done means a remote ChatGPT Work/Codex runtime can authenticate an existing Kling account and kling who_am_i reports the saved login state without local port forwarding.